Hoher Datenverbrauch. Malware im Hintergrund?

Damnation · 09.09.2014, 14:22

Hey.

Seit kurzem ist der Datenverbrauch hier 20x so hoch wie normal.

Danke für eure Hilfe!!!

Hier anbei die Logs:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-09 15:00:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000057 WDC_WD25 rev.01.0 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Lisie\AppData\Local\Temp\kwldapog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000766d1465 2 bytes [6D, 76]
.text   C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000766d14bb 2 bytes [6D, 76]
.text   ...                                                                                                                            * 2
.text   C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3700] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69       00000000766d1465 2 bytes [6D, 76]
.text   C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3700] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155      00000000766d14bb 2 bytes [6D, 76]
.text   ...                                                                                                                            * 2

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [5040:3724]                                                                                    000007feecff9688

---- EOF - GMER 2.1 ----

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:42 on 09/09/2014 (Lisie)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-09-2014 01
Ran by Lisie (administrator) on Lisiepc on 09-09-2014 14:43:29
Running from C:\Users\Lisie\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Fujitsu Technology Solutions) C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Fujitsu Technology Solutions) C:\Program Files (x86)\Fujitsu\DeskViewBasic\DeskViewBasicService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(APN LLC.) C:\Users\Lisie\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC\IdcLdr.exe
(APN LLC.) C:\Users\Lisie\AppData\Local\AskPartnerNetwork\Toolbar\Updater\IDC\IdcLdr_x64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
() C:\Program Files (x86)\Mozilla Firefox\updated\firefox.exe
() C:\Users\Lisie\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8158240 2009-10-06] (Realtek Semiconductor)
HKLM-x32\...\Run: [DeskViewBasic] => C:\Program Files (x86)\Fujitsu\DeskViewBasic\DeskViewBasic.exe [182784 2009-08-19] (Fujitsu Technology Solutions)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [614400 2009-08-15] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-08] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime Alternative\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-08-29] (APN)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: {39aa748d-c6b4-11e0-8827-001999757147} - F:\AutoRun.exe
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: {5b75e237-3f2b-11df-8a7e-001999757147} - F:\AutoRun.exe
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: {619ce4f1-c753-11e0-80cc-001999757147} - F:\AutoRun.exe
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: {619ce4f4-c753-11e0-80cc-001999757147} - F:\AutoRun.exe
HKU\S-1-5-21-2953934859-215879231-4136201606-1000\...\MountPoints2: {619ce518-c753-11e0-80cc-001999757147} - F:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)
Startup: C:\Users\Lisie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Cyber-shot Viewer-Medien-Prüfung.lnk
ShortcutTarget: Cyber-shot Viewer-Medien-Prüfung.lnk -> C:\Program Files (x86)\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation)
Startup: C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LaunchCenter.lnk
ShortcutTarget: LaunchCenter.lnk -> C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ts.fujitsu.com/index2
URLSearchHook: HKCU - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll (APN LLC.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - 630A4F95E65E40B8B881803E6DFDD7D5 URL = hxxp://search.softonic.com/MON00015/tb_v1?q={searchTerms}&SearchSource=4&cc=
SearchScopes: HKCU - {0D7562AE-8EF6-416d-A838-AB665251703A} URL = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4
SearchScopes: HKCU - {A3CF3856-91D6-4061-B05C-5215F8D740B9} URL = 
SearchScopes: HKCU - {B253DBED-963D-4404-986C-BEEA220992EC} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYAT&apn_uid=C08A3009-BCD0-4361-A149-9D0593A730D0&apn_sauid=5E366080-6C64-4C57-8186-C2CB000FB9FF
BHO: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Avira SearchFree Toolbar -> {41564952-412D-5637-00A7-7A786E7484D7} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport_x64.dll (APN LLC.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\..\Interfaces\{326AB392-3BA1-4AB1-89C7-A15206C2EB87}: [NameServer] 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035\searchplugins\bingp.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: German Dictionary, extended for Austria - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\Extensions\de-AT@dictionaries.addons.mozilla.org [2010-12-25]
FF Extension: British English Dictionary - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\Extensions\en-GB@dictionaries.addons.mozilla.org [2010-12-25]
FF Extension: Softonic Toolbar - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\Extensions\ffxtlbra@softonic.com [2012-03-09]
FF Extension: Greasemonkey - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-02]
FF Extension: Adblock Plus - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\lpy0su8w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-06-15]
FF Extension: Flash Video Downloader - YouTube Full HD Download - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035\Extensions\artur.dubovoy@gmail.com [2014-09-09]
FF Extension: Flash and Video Download - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2014-09-09]
FF Extension: Adblock Edge - C:\Users\Lisie\AppData\Roaming\Mozilla\Firefox\Profiles\9fcz10z7.default-1345307638035\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2013-09-11]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-08]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-09-08]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-08]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-08-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-08] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-08-29] (APN LLC.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 DeskViewBasicService; C:\Program Files (x86)\Fujitsu\DeskViewBasic\DeskViewBasicService.exe [34816 2009-08-19] (Fujitsu Technology Solutions) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 TestHandler; C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [341264 2009-02-19] (Fujitsu Technology Solutions)
S4 uvnc_service; C:\Program Files (x86)\UltraVNC\WinVNC.exe [1590216 2009-12-07] (UltraVNC)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-05-22] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-06-09] (Samsung Electronics Co., Ltd.)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-09 14:43 - 2014-09-09 14:44 - 00019367 _____ () C:\Users\Lisie\Desktop\FRST.txt
2014-09-09 14:43 - 2014-09-09 14:43 - 00000000 ____D () C:\FRST
2014-09-09 14:42 - 2014-09-09 14:42 - 00000472 _____ () C:\Users\Lisie\Desktop\defogger_disable.log
2014-09-09 14:42 - 2014-09-09 14:42 - 00000000 _____ () C:\Users\Lisie\defogger_reenable
2014-09-09 14:40 - 2014-09-09 14:41 - 02105344 _____ (Farbar) C:\Users\Lisie\Desktop\FRST64.exe
2014-09-09 14:40 - 2014-09-09 14:40 - 00380416 _____ () C:\Users\Lisie\Desktop\Gmer-19357.exe
2014-09-09 14:40 - 2014-09-09 14:40 - 00050477 _____ () C:\Users\Lisie\Desktop\Defogger.exe
2014-09-09 14:32 - 2014-09-09 14:32 - 00000209 _____ () C:\Users\Lisie\Desktop\text.csv
2014-09-08 14:40 - 2014-09-09 14:44 - 00000000 ____D () C:\Users\Lisie\AppData\Roaming\NetSpeedMonitor
2014-09-08 14:39 - 2014-09-08 14:40 - 00000000 ____D () C:\Program Files\NetSpeedMonitor
2014-09-08 14:38 - 2014-09-08 14:38 - 04307776 _____ (Cucusoft, Inc. ) C:\Users\Lisie\Downloads\netguard.exe
2014-09-08 14:37 - 2014-09-08 14:37 - 03652608 _____ () C:\Users\Lisie\Downloads\netspeedmonitor_2_5_4_0_x64_setup.msi
2014-09-08 13:24 - 2014-09-08 13:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-04 15:22 - 2014-09-04 15:22 - 00019842 _____ () C:\Users\Lisie\Downloads\eBayISAPI(8).dll
2014-08-28 10:57 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 10:57 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 10:57 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-28 10:48 - 2014-08-28 10:48 - 00001103 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-15 13:44 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-15 13:44 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 13:44 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-15 13:44 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-15 13:43 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-15 13:43 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-15 13:43 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-15 13:43 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-15 13:43 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-15 13:43 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-15 13:43 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-15 13:43 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-15 13:43 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-15 13:43 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-15 13:43 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 13:43 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 13:43 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 13:43 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 13:43 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 13:43 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 13:43 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-15 13:43 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 13:42 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-15 13:42 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-15 13:42 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-15 13:42 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-15 13:42 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-15 13:42 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-15 13:42 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-15 13:42 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-15 13:42 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-15 13:42 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-15 13:42 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-15 13:42 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-15 13:42 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-15 13:42 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-15 13:42 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-15 13:42 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-15 13:42 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-15 13:42 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-15 13:42 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-15 13:42 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-15 13:42 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-15 13:42 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-15 13:42 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-15 13:42 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-15 13:42 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-15 13:42 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-15 13:42 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-15 13:42 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-15 13:42 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-15 13:42 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-15 13:42 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-15 13:42 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-15 13:42 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-15 13:42 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-15 13:42 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-15 13:42 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-15 13:42 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-15 13:42 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-15 13:42 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-15 13:42 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-15 13:42 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-15 13:42 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-15 13:42 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-15 13:42 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-15 13:42 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-15 13:42 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-15 13:42 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-15 13:42 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-15 13:42 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-15 13:42 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-15 13:42 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-15 13:42 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-15 13:41 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 13:41 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-15 13:40 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-15 13:40 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-15 13:40 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-15 13:40 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-12 13:23 - 2014-08-12 13:23 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-12 13:23 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-12 13:23 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-12 13:23 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-12 13:23 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-09 14:44 - 2014-09-09 14:43 - 00019367 _____ () C:\Users\Lisie\Desktop\FRST.txt
2014-09-09 14:44 - 2014-09-08 14:40 - 00000000 ____D () C:\Users\Lisie\AppData\Roaming\NetSpeedMonitor
2014-09-09 14:43 - 2014-09-09 14:43 - 00000000 ____D () C:\FRST
2014-09-09 14:42 - 2014-09-09 14:42 - 00000472 _____ () C:\Users\Lisie\Desktop\defogger_disable.log
2014-09-09 14:42 - 2014-09-09 14:42 - 00000000 _____ () C:\Users\Lisie\defogger_reenable
2014-09-09 14:42 - 2010-04-03 16:23 - 00000000 ____D () C:\Users\Lisie
2014-09-09 14:41 - 2014-09-09 14:40 - 02105344 _____ (Farbar) C:\Users\Lisie\Desktop\FRST64.exe
2014-09-09 14:40 - 2014-09-09 14:40 - 00380416 _____ () C:\Users\Lisie\Desktop\Gmer-19357.exe
2014-09-09 14:40 - 2014-09-09 14:40 - 00050477 _____ () C:\Users\Lisie\Desktop\Defogger.exe
2014-09-09 14:32 - 2014-09-09 14:32 - 00000209 _____ () C:\Users\Lisie\Desktop\text.csv
2014-09-09 14:26 - 2011-06-19 21:32 - 00000000 ____D () C:\Users\Lisie\AppData\Roaming\Skype
2014-09-09 14:23 - 2012-06-11 07:37 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-09 14:10 - 2010-04-04 01:12 - 01054710 _____ () C:\Windows\WindowsUpdate.log
2014-09-09 14:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-09 13:37 - 2013-12-26 17:44 - 00040960 _____ () C:\Users\Lisie\Desktop\Gebrauchtwaren eBay-Amazon-Kleinanzeigen - 2014.xls
2014-09-09 13:04 - 2010-04-03 19:24 - 00000000 ____D () C:\Users\Lisie\AppData\Local\Thunderbird
2014-09-08 14:40 - 2014-09-08 14:39 - 00000000 ____D () C:\Program Files\NetSpeedMonitor
2014-09-08 14:38 - 2014-09-08 14:38 - 04307776 _____ (Cucusoft, Inc. ) C:\Users\Lisie\Downloads\netguard.exe
2014-09-08 14:37 - 2014-09-08 14:37 - 03652608 _____ () C:\Users\Lisie\Downloads\netspeedmonitor_2_5_4_0_x64_setup.msi
2014-09-08 14:11 - 2010-04-03 16:23 - 00000000 ____D () C:\Users\Lisie\AppData\Local\Adobe
2014-09-08 14:08 - 2012-06-11 07:37 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-08 14:08 - 2012-06-11 07:37 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-08 14:08 - 2012-03-09 18:15 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-08 13:24 - 2014-09-08 13:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-08 13:24 - 2014-06-13 13:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-09-08 13:24 - 2012-05-06 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-08 08:00 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-08 08:00 - 2009-07-14 06:45 - 00021680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-07 20:15 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-07 20:15 - 2009-07-14 06:51 - 00158189 _____ () C:\Windows\setupact.log
2014-09-05 09:17 - 2010-04-03 19:26 - 00000000 ____D () C:\Users\Lisie\Documents\Hund und Katze
2014-09-05 08:10 - 2010-04-04 01:09 - 00138302 _____ () C:\Windows\PFRO.log
2014-09-04 16:35 - 2010-05-04 15:46 - 00124416 ___SH () C:\Users\Lisie\Documents\Thumbs.db
2014-09-04 15:22 - 2014-09-04 15:22 - 00019842 _____ () C:\Users\Lisie\Downloads\eBayISAPI(8).dll
2014-08-29 17:08 - 2010-04-04 12:27 - 00000000 ____D () C:\ProgramData\Skype
2014-08-29 16:56 - 2009-07-14 06:45 - 00469184 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 10:49 - 2014-08-08 09:39 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-28 10:48 - 2014-08-28 10:48 - 00001103 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-28 10:48 - 2013-08-06 09:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-28 10:48 - 2013-08-06 09:43 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-23 04:07 - 2014-08-28 10:57 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 10:57 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 10:57 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-17 07:00 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-16 21:01 - 2014-05-01 03:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-15 13:48 - 2013-08-14 15:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-15 13:45 - 2010-04-03 17:45 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-12 13:29 - 2013-08-06 09:44 - 00000000 ____D () C:\Program Files (x86)\AskPartnerNetwork
2014-08-12 13:24 - 2013-11-24 10:13 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-12 13:23 - 2014-08-12 13:23 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-12 13:23 - 2012-09-15 08:47 - 00000000 ____D () C:\Program Files (x86)\Java

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Lisie\AppData\Local\Temp\APNSetup.exe
C:\Users\Lisie\AppData\Local\Temp\avgnt.exe
C:\Users\Lisie\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\Lisie\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Lisie\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Lisie\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Lisie\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Lisie\AppData\Local\Temp\ResetDevice.exe
C:\Users\Lisie\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-06 12:26

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-09-2014 01
Ran by Lisie at 2014-09-09 14:45:08
Running from C:\Users\Lisie\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.179 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.7.148 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{e67154a7-9cc5-4167-b782-f3982bc6c70d}) (Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Avira SearchFree Toolbar (HKLM-x32\...\{41564952-412D-5637-00A7-A758B70C0F05}) (Version: 12.15.5.1034 - APN, LLC)
CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version:  - )
Java 7 Update 10 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417010FF}) (Version: 7.0.100 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216035FF}) (Version: 6.0.370 - Oracle)
LibreOffice 4.1.4.2 (HKLM-x32\...\{94E11973-ED58-47A0-907C-ABF6D95C5DD8}) (Version: 4.1.4.2 - The Document Foundation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (Version: 2.3.188.0 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0 (x86 de)) (Version: 32.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.1.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.1.0 (x86 de)) (Version: 31.1.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NetSpeedMonitor 2.5.4.0 x64 (HKLM\...\{88F41EE2-949B-4B52-933D-C7F8F67BC1D2}) (Version: 2.5.4.0 - Florian Gilles)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA Grafiktreiber 307.83 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 307.83 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 307.83 (Version: 307.83 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
QuickTime Alternative 3.2.2 (HKLM-x32\...\QuicktimeAlt_is1) (Version: 3.2.2 - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5953 - Realtek Semiconductor Corp.)
Samsung ML-1640 Series (HKLM-x32\...\Samsung ML-1640 Series) (Version:  - Samsung Electronics CO.,LTD)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.2.912.21200 - SAMSUNG Electronics Co., Ltd.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Softwarenetz Haushaltsbuch4 (HKLM-x32\...\Haushaltsbuch4) (Version:  - )
Sony Picture Utility (HKLM-x32\...\{D5068583-D569-468B-9755-5FBF5848F46F}) (Version: 1.0.00.14080 - Sony Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
SystemDiagnostics (HKLM-x32\...\{EF59DB7F-7426-426E-B862-7031F83ED304}) (Version: 2.04.0006 - Fujitsu Technology Solutions)
UltraVNC 1.0.8.2 (HKLM-x32\...\Ultravnc2_is1) (Version: 1.0.8.2 - 1.0.8.2)
Win7codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 3.9.2 - Shark007)
x64 Components v3.9.2 (HKLM\...\x64 Components_is1) (Version: 3.9.2 - Shark007)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

09-09-2014 06:51:51 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0B9D3B35-2419-463A-AA14-715B8AA19D8A} - System32\Tasks\{5E6E4F12-1863-4651-825E-494C5DE8FA0B} => Firefox.exe hxxp://ui.skype.com/ui/0/6.14.0.104/de/abandoninstall?page=tsPlugin
Task: {154EBB93-059F-4047-9C28-EFF04B14278B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-08] (Adobe Systems Incorporated)
Task: {2E55AD07-7E34-4CFE-9D45-E429290EC39E} - System32\Tasks\{41EBA4E2-3D96-4D4C-A2CB-ED258AE2A28B} => D:\Installer\lide25vst11012de\SetupSG.exe
Task: {3B0E6A61-C6D8-42D3-8E6C-DD716D7413B6} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {5FDF89A7-2AC7-4FAA-B61C-85C8466FEFAE} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {68035BAC-7319-497A-BF5A-BC7D441123FB} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {7FD4653A-538A-458A-90F2-FCAF7308C53D} - System32\Tasks\{79E16FF5-B12F-4BD4-A9BA-2073A24BEA4D} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-07-24] (Skype Technologies S.A.)
Task: {C00B6EAD-CAAD-4A21-B271-9934582B7726} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {E10ED38E-8027-40DD-B4C1-3B88B6772B5A} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {E866C9FB-1CC4-444F-B3ED-36C075C72762} - System32\Tasks\{B5D6E03C-CC29-4829-875F-DB36809C8665} => C:\Program Files (x86)\LibreOffice 3\program\soffice.exe
Task: {FF65D929-1F97-465E-A1FB-D7D1640C27F7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-04-03 19:55 - 2008-01-11 06:19 - 00022016 _____ () C:\Windows\System32\ssp2ml6.dll
2013-04-14 21:29 - 2013-01-31 11:25 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-04-03 19:55 - 2009-08-15 06:38 - 00614400 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2010-04-03 19:55 - 2008-01-11 07:39 - 00327168 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2014-09-09 14:40 - 2014-09-09 14:40 - 00050477 _____ () C:\Users\Lisie\Desktop\Defogger.exe
2014-08-04 14:20 - 2014-08-04 14:20 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-04 14:20 - 2014-08-04 14:20 - 00067832 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2014-08-08 09:39 - 2014-08-04 14:20 - 00052472 _____ () C:\Users\Lisie\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-06-13 13:41 - 2014-09-08 13:24 - 03339376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-06-13 13:41 - 2014-09-08 13:24 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-06-13 13:41 - 2014-09-08 13:24 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-09-08 13:24 - 2014-09-08 13:24 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: APNMCP => 2
MSCONFIG\Services: Dyn Updater => 2
MSCONFIG\Services: uvnc_service => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Dyn Updater Tray Icon.lnk => C:\Windows\pss\Dyn Updater Tray Icon.lnk.CommonStartup
MSCONFIG\startupreg: ApnTBMon => "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodssrv.exe" /md I

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/09/2014 10:08:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Toolbar.exe, Version: 21.8.0.261, Zeitstempel: 0x5395ff08
Name des fehlerhaften Moduls: so.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5395feff
Ausnahmecode: 0xc0000005
Fehleroffset: 0x60b4795f
ID des fehlerhaften Prozesses: 0x16bc
Startzeit der fehlerhaften Anwendung: 0xToolbar.exe0
Pfad der fehlerhaften Anwendung: Toolbar.exe1
Pfad des fehlerhaften Moduls: Toolbar.exe2
Berichtskennung: Toolbar.exe3

Error: (09/09/2014 10:04:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Toolbar.exe, Version: 21.8.0.261, Zeitstempel: 0x5395ff08
Name des fehlerhaften Moduls: so.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5395feff
Ausnahmecode: 0xc0000005
Fehleroffset: 0x5e1a795f
ID des fehlerhaften Prozesses: 0x1700
Startzeit der fehlerhaften Anwendung: 0xToolbar.exe0
Pfad der fehlerhaften Anwendung: Toolbar.exe1
Pfad des fehlerhaften Moduls: Toolbar.exe2
Berichtskennung: Toolbar.exe3

Error: (09/08/2014 06:21:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Toolbar.exe, Version: 21.8.0.261, Zeitstempel: 0x5395ff08
Name des fehlerhaften Moduls: so.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5395feff
Ausnahmecode: 0xc0000005
Fehleroffset: 0x6074795f
ID des fehlerhaften Prozesses: 0xe50
Startzeit der fehlerhaften Anwendung: 0xToolbar.exe0
Pfad der fehlerhaften Anwendung: Toolbar.exe1
Pfad des fehlerhaften Moduls: Toolbar.exe2
Berichtskennung: Toolbar.exe3

Error: (09/08/2014 02:23:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (09/08/2014 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 31.0.0.5310, Zeitstempel: 0x53c75e91
Name des fehlerhaften Moduls: mozalloc.dll, Version: 31.0.0.5310, Zeitstempel: 0x53c72e91
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1230
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (09/08/2014 01:51:09 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (09/08/2014 01:50:53 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (09/08/2014 01:50:52 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (09/08/2014 01:50:51 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox

Error: (09/08/2014 01:50:50 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox


System errors:
=============
Error: (09/09/2014 08:41:48 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/08/2014 01:47:47 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/07/2014 08:15:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/07/2014 05:59:50 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/07/2014 05:59:42 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.

Error: (09/07/2014 09:12:07 AM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (09/07/2014 09:05:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DeskViewBasicService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/07/2014 09:05:00 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst DeskViewBasicService erreicht.

Error: (09/07/2014 09:04:17 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (09/06/2014 11:41:20 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20


Microsoft Office Sessions:
=========================
Error: (09/09/2014 10:08:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Toolbar.exe21.8.0.2615395ff08so.dll_unloaded0.0.0.05395feffc000000560b4795f16bc01cfcc0527936e70C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Toolbar.exeso.dll6bb7eb30-37f8-11e4-812c-001999757147

Error: (09/09/2014 10:04:30 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Toolbar.exe21.8.0.2615395ff08so.dll_unloaded0.0.0.05395feffc00000055e1a795f170001cfcc04a09d90d0C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Toolbar.exeso.dllec829c70-37f7-11e4-812c-001999757147

Error: (09/08/2014 06:21:18 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Toolbar.exe21.8.0.2615395ff08so.dll_unloaded0.0.0.05395feffc00000056074795fe5001cfcb80e56bbf90C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Toolbar.exeso.dll296c87b0-3774-11e4-812c-001999757147

Error: (09/08/2014 02:23:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestD:\Installer\SoftonicDownloader_fuer_microsoft-office-powerpoint-viewer.exe

Error: (09/08/2014 01:51:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe31.0.0.531053c75e91mozalloc.dll31.0.0.531053c72e91800000030000141b123001cfcb4d82f1d1c0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll6e602910-374e-11e4-812c-001999757147

Error: (09/08/2014 01:51:09 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (09/08/2014 01:50:53 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (09/08/2014 01:50:52 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (09/08/2014 01:50:51 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)

Error: (09/08/2014 01:50:50 PM) (Source: MsiInstaller) (EventID: 10005) (User: Lisiepc)
Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: 

Mozilla Firefox	(NULL)(NULL)(NULL)(NULL)(NULL)


==================== Memory info =========================== 

Processor: Pentium(R) Dual-Core CPU E6300 @ 2.80GHz
Percentage of memory in use: 77%
Total physical RAM: 1790.42 MB
Available physical RAM: 394.39 MB
Total Pagefile: 3580.84 MB
Available Pagefile: 1008.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:50 GB) (Free:4.3 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:34.39 GB) (Free:32.55 GB) NTFS
Drive f: (Volume) (Fixed) (Total:146.48 GB) (Free:144.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 27987793)
Partition 1: (Active) - (Size=2 GB) - (Type=27)
Partition 2: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=34.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=146.5 GB) - (Type=OF Extended)

==================== End Of Log ============================

cosinus · 09.09.2014, 14:49

Was verstehst du unter "hier"?
Wie viele Rechner teilen sich den Internetanschluss?

Damnation · 09.09.2014, 14:57

Zitat:

Zitat von cosinus

Was verstehst du unter "hier"?
Wie viele Rechner teilen sich den Internetanschluss?

Sorry. Bin grad auf Heimaturlaub bei meiner Mutter. Nur ein PC. Kein WLAN vorhanden.

Sie hatte bis vor ein paar Monaten 2000mb flat und das hat gereicht. Mittlerweile werden bis zu 2000mb am Tag Daten verbraucht. Das kam sehr plötzlich, deswegen die Frage. Sie hat mittlerweile ne Flat, aber will das trotzdem gerne überprüfen.

Danke

cosinus · 09.09.2014, 15:40

Im Nachhinein lässt sich schwer bis garnicht mehr feststellen was denn genau den Traffic verursacht hat. Windows-Updates können gerne was verbraten und wenn deine Mutter hin und wieder bei Youtube ist, erzeugt das auch Traffic.

Woher weißt du eigentlich wieviel Traffic du hast. Wo genau liest du das ab?

Damnation · 09.09.2014, 15:46

Zitat:

Zitat von cosinus

Im Nachhinein lässt sich schwer bis garnicht mehr feststellen was denn genau den Traffic verursacht hat. Windows-Updates können gerne was verbraten und wenn deine Mutter hin und wieder bei Youtube ist, erzeugt das auch Traffic.

Woher weißt du eigentlich wieviel Traffic du hast. Wo genau liest du das ab?

Unser Internetprovider bietet das an. Kann da genau jeden Tag nachvollziehen, was da verbraucht wird.
Leider ist der verbrauch immer noch hoch, warum es mich halt wundert. Die Logs sagen nichts aus?

cosinus · 09.09.2014, 16:23

Du brauchst mehr Anhaltspunkte. FRST-Logs sind gedacht um Malware zu finden, nachträgliche trafficschleudern findet man nicht. Und hoher traffic allein ist auch kein Indiz für Befall.

Traffic messen => NetWorx - Download - heise online

09.09.2014, 14:49	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Hoher Datenverbrauch. Malware im Hintergrund? Was verstehst du unter "hier"? Wie viele Rechner teilen sich den Internetanschluss? __________________ __________________

09.09.2014, 16:23	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Hoher Datenverbrauch. Malware im Hintergrund? Du brauchst mehr Anhaltspunkte. FRST-Logs sind gedacht um Malware zu finden, nachträgliche trafficschleudern findet man nicht. Und hoher traffic allein ist auch kein Indiz für Befall. Traffic messen => NetWorx - Download - heise online __________________ --> Hoher Datenverbrauch. Malware im Hintergrund?

Hoher Datenverbrauch. Malware im Hintergrund?

Log-Analyse und Auswertung: Hoher Datenverbrauch. Malware im Hintergrund?